Guide to Network Security chapter 11 & 12

Guide to Network Security chapter 11 & 12 detailed description of the activities that occur during an attack, including preliminary indications of the attack as well as the actions taken and the outcome - attack profile the work team responsible for development, testing, management, and execution of the business continuity plan - business continuity (BC) team planning process to ensure that critical business functions can continue if a disaster occurs - business continuity planning combination of the Business Continuity and Disaster Recovery plans - Business Resumption Plan an attack that affects information resources and/or assets, causing actual damage or other disruptions - computer incident a group of individuals who will be mobilized when a computer incident is detected and the incident response plan is activated - Computer Security Incident Response Team the group of employees responsible for managing the overall CP process - CP Management Team (CP Team) a backup of all files that have changed or have been added since the last full backup - differential backup planning process to ensure that critical business functions can continue if a disaster occurs, through specific steps to reestablish operations at the primary or new permanent site after the disaster - Disaster recovery planning an implementation of RAID data storage in which the system writes data to two drives simultaneously, providing a backup if the primary drive fails - disk mirroring (RAID 1) an implementation of RAID data storage in which the system creates one larger logical volume across several available physical hard drives and stores the data in segments or stripes - disk striping (RAID 0) related to business continuity, an unexpected activity that might escalate or be later categorized as an incident or disaster - event complete backup of the entire system, including all applications, operating systems components, and data - full backup back methodology that uses five media sets per week and allows recovery of data for the previous three weeks - Grandfather-Father-Son backup an attack that affects resources and/or assets, potentially causing disclosure, damage, or other disruptions - incident a set of defined actions taken by an organization when a suspicious event is detected or while an incident is in progress - incident response (IR) plan the group of employees responsible for for development, testing, management, and execution of the IR plan - incident response (IR) team the process that encompasses all the actions an organization takes when an intrusion is detected - incident response a data backup scheme in which all files that have been modified since the last backup are archived - incremental backup data storage via a single device or server that attaches to a network - network-attached storage transfer of live transactions to an off-site facility - remote journaling contractual documents guaranteeing certain minimum levels of service provided by vendors - service level agreements backup methodology that rotates six sets of media - six-tape rotation data storage similar to a NAS that provides higher speed and higher security - storage area networks complex backup methodology that uses statistical principles to optimize media wear - Towers of Hanoi a legal record of where the evidence was at each point in its lifetime as well as documentation of each access there was to it - chain of custody the use of technical investigation and analysis techniques to identify, collect, preserve, and analyze electronic items of potential evidentiary value so that they may be admitted as evidence in a court of law, used to support administrative action, or simply used to further analyze suspicious data. - computer forensics powering down a system to copy the data (digital evidence) from the hard drives - dead acquisition the application of computer forensics to all modern electronic devices, including mobile phones, PDAs, portable music players, and other electronic devices capable of storing digital information - digital forensics collecting digital evidence from a currently running system - live acquisition devices that allow an investigator to acquire that information on a drive without accidentally damaging the drive's contents - write blockers What is a drawback of tape backups? - time required to store and retrieve information A(n) ______ backup is the storage of all files that have changed or have been added since the last full backup. - differential